The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive conversation transcripts stored in ~/.claude/projects. These files contain the full history of interactions, which can include private data, proprietary code, or credentials discussed in previous sessions. While this access is required for the skill's core functionality, it represents a significant data exposure surface.- [COMMAND_EXECUTION]: The skill executes multiple shell commands to gather evidence, including find, grep, jq, and git log. These are used to traverse the filesystem, extract metadata, and process content from project directories and git repositories.- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8). Ingestion points: Untrusted data is ingested from session transcripts (~/.claude/projects/**/*.jsonl), git logs, and file artifacts modified in project directories. Boundary markers: The instructions do not specify the use of boundary markers or delimiters to isolate content from different sessions or to warn the agent about potential instructions embedded in the transcripts. Capability inventory: The skill has the ability to read all files in the ~/.claude/projects directory and write reports and logs to ~/Desktop/晨报/. Sanitization: There is no evidence of sanitization or filtering of the content extracted from transcripts before it is synthesized into the final report. Malicious instructions embedded in a previous session (e.g., from a malicious file or a prompt injection attack in a past conversation) could potentially influence the summary or the proposed efficiency suggestions.

morning-brief